--- id: acquire version: "3.22" license: AGPL-3.0-or-later license_treatment: agpl maintenance: active --- # acquire — A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container License: agpl · Maintenance: active · Downloads: 158.4K/mo ## What it is and what it does Acquire is a forensic triage tool that rapidly collects artifacts from disk images or running systems into a portable container format. It leverages the dissect framework to parse raw disk structures when possible, making it useful for digital forensic investigations and incident response workflows. The tool operates through configurable profiles (full, default, minimal, none) and module-based artifact gathering, with OS-specific logic to collect relevant evidence. It requires administrative access to read raw disk data but offers fallback modes to use the operating system for file access when direct disk reading is unavailable. The package is maintained as part of the broader Dissect project by Fox-IT/NCC Group, with active development and a production-stable classification. It depends on dissect.cstruct and dissect.target for its core functionality, and is distributed as a pure Python wheel with low installation friction. Use it for: - Quickly triage a compromised system by collecting forensic artifacts into a portable container for offline analysis. - Automate forensic evidence gathering from disk images during incident response workflows. - Extract OS-specific artifacts from live systems using profile-based collection (full, default, minimal). - Gather raw disk data when direct access is available, with automatic fallback to OS-level file access. - Build forensic investigation pipelines that integrate artifact collection via the dissect framework. ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. Acquire gathers forensic artifacts from disk images or live systems into a lightweight container, using the dissect framework to extract data from raw disk when possible. Yes, if you need forensic artifact collection from disk images or live systems. The tool is actively maintained, has low install friction, and fills a specific role in digital forensics and incident response. The AGPL-3.0-or-later license requires copyleft compliance, which is appropriate for open-source forensic work but should be reviewed if you plan proprietary modifications. Requires Python >=3.10 and administrative access. ## Install pip install acquire uv add acquire poetry add acquire ## Installing acquire Before you install: Low install friction with a pure Python wheel. Active maintenance as of 2026-08-12 with a recent release on 2026-02-25. Requires Python >=3.10 and administrative access to read raw disk data, though fallback options exist. License in practice: Licensed under AGPL-3.0-or-later, which requires that any modifications or derivative works be distributed under the same license and made available to users. This is a strong copyleft obligation suitable for open-source projects but may constrain commercial or proprietary use. Quickstart: pip install acquire from acquire import ... sudo acquire Requires Python >=3.10 and administrative (root/sudo) access to read raw disk data; fallback modes available via --fallback or --force-fallback flags. Verify before relying: - Exact API surface and programmatic usage patterns beyond the CLI tool - Performance characteristics on large disk images or systems - Supported operating systems and artifact types beyond OS detection ## Package facts - License: AGPL-3.0-or-later (agpl) - Python support: supports_current - Install friction: low - Maintenance: active - Downloads: 158.4K/month (top 15,000 on PyPI) - Known vulnerabilities: none known ## Tags forensic artifact collection, disk image triage, live system forensics, digital forensic acquisition, raw disk data extraction, forensic container, incident response triage, forensics, incident-response, triage [View on SkillFed](https://skillfed.io/packages/acquire) · [View on PyPI](https://pypi.org/project/acquire/)